The present invention is related to computer security, and more specifically related to protection of computer systems against denial-of-service (DoS) attacks.
ISO Layer 7 (Application Layer) DoS Attacks are attacks against servers in which an attacker imitates a valid application workflow, and aims to make the server unavailable by flooding the server with requests. Servers are vulnerable to this type of attack when users of the service are not yet authenticated, such as during a registration process. A feature of Layer 7 DoS attacks is asymmetric work loading. Attackers aim to do little work in order to cause the server to perform many operations. A DoS attack may be launched from a single machine/connection or from a collection of different machines/connections, in which case the DoS attack is commonly referred to as a “distributed” denial-of-service (DDoS) attack.
An example of a Layer 7 DoS attack is as follows. An attacker emulates a registration workflow of a device, such as an Internet of Things (IoT) device, in which the device sends a device id encrypted with a server RSA key. The attacker only has to do a relatively low-effort RSA public key operation, while the server has to perform a relatively expensive RSA private key operation plus perform database look-ups prior to determining that the device id is invalid and discarding the request. In this way, the attacker is able to flood the IoT device registration process.
Another example is mobile app registration. No user authentication occurs early in the registration process. Thus an attacker can perform small amounts of work on the client side (issuing apparently valid registration requests) to result in large amounts of work on the server side (processing the requests up to a point of identifying the user as not authorized, etc.).
It is known to use so-called “puzzle” approaches as an aid in thwarting or reducing the impact of DoS attacks. A server responds to an initial request by first requiring the requestor to perform a non-trivial calculation. Only when a requestor provides evidence of having performed the calculation correctly (“solving the puzzle”) does the server take further action on the request. Because the requestor is forced to perform work as a condition to the server processing the request, the desired effect of flooding the server with work is not obtained.